octeontx2-af: avoid off-by-one read from userspace
authorBui Quang Minh <minhquangbui99@gmail.com>
Wed, 24 Apr 2024 14:44:23 +0000 (21:44 +0700)
committerJakub Kicinski <kuba@kernel.org>
Fri, 26 Apr 2024 02:23:51 +0000 (19:23 -0700)
commitf299ee709fb45036454ca11e90cb2810fe771878
tree372ccd84a71818b0731f7ef829fbb527541f6d7f
parent8c34096c7fdf272fd4c0c37fe411cd2e3ed0ee9f
octeontx2-af: avoid off-by-one read from userspace

We try to access count + 1 byte from userspace with memdup_user(buffer,
count + 1). However, the userspace only provides buffer of count bytes and
only these count bytes are verified to be okay to access. To ensure the
copied buffer is NUL terminated, we use memdup_user_nul instead.

Fixes: 3a2eb515d136 ("octeontx2-af: Fix an off by one in rvu_dbg_qsize_write()")
Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com>
Link: https://lore.kernel.org/r/20240424-fix-oob-read-v2-6-f1f1b53a10f4@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c